linux-stable.git/drivers/net/can, branch v3.2.83

can: fix oops caused by wrong rtnl dellink usage

2016-08-22T21:37:15+00:00

commit 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 upstream.

For 'real' hardware CAN devices the netlink interface is used to set CAN
specific communication parameters. Real CAN hardware can not be created nor
removed with the ip tool ...

This patch adds a private dellink function for the CAN device driver interface
that does just nothing.

It's a follow up to commit 993e6f2fd ("can: fix oops caused by wrong rtnl
newlink usage") but for dellink.

Reported-by: ajneu 
Signed-off-by: Oliver Hartkopp 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings

can: at91_can: RX queue could get stuck at high bus load

2016-08-22T21:37:15+00:00

commit 43200a4480cbbe660309621817f54cbb93907108 upstream.

At high bus load it could happen that "at91_poll()" enters with all RX
message boxes filled up. If then at the end the "quota" is exceeded as
well, "rx_next" will not be reset to the first RX mailbox and hence the
interrupts remain disabled.

Signed-off-by: Wolfgang Grandegger 
Tested-by: Amr Bekhit 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings

can: ems_usb: Fix possible tx overflow

2016-04-01T00:54:34+00:00

commit 90cfde46586d2286488d8ed636929e936c0c9ab2 upstream.

This patch fixes the problem that more CAN messages could be sent to the
interface as could be send on the CAN bus. This was more likely for slow baud
rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
heavy TX load this produced another bulk transfer without checking the
free_slots variable and hence caused the overflow in the interface.

Signed-off-by: Gerhard Uttenthaler 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings

can: sja1000: clear interrupts on start

2015-12-30T02:25:57+00:00

commit 7cecd9ab80f43972c056dc068338f7bcc407b71c upstream.

According to SJA1000 data sheet error-warning (EI) interrupt is not
cleared by setting the controller in to reset-mode.

Then if we have the following case:
- system is suspended (echo mem > /sys/power/state) and SJA1000 is left
  in operating state
- A bus error condition occurs which activates EI interrupt, system is
  still suspended which means EI interrupt will be not be handled nor
  cleared.

If the above two events occur, on resume there is no way to return the
SJA1000 to operating state, except to cycle power to it.

By simply reading the IR register on start we will clear any previous
conditions that could be present.

Signed-off-by: Mirza Krak 
Reported-by: Christian Magnusson 
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2: s/SJA1000_IR/REG_IR/]
Signed-off-by: Ben Hutchings

can: Use correct type in sizeof() in nla_put()

2015-11-27T12:48:22+00:00

commit 562b103a21974c2f9cd67514d110f918bb3e1796 upstream.

The sizeof() is invoked on an incorrect variable, likely due to some
copy-paste error, and this might result in memory corruption. Fix this.

Signed-off-by: Marek Vasut 
Cc: Wolfgang Grandegger 
Cc: netdev@vger.kernel.org
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2:
 - Keep using the old NLA_PUT macro
 - Adjust context]
Signed-off-by: Ben Hutchings

can: add missing initialisations in CAN related skbuffs

2015-05-09T22:16:27+00:00

commit 969439016d2cf61fef53a973d7e6d2061c3793b1 upstream.

When accessing CAN network interfaces with AF_PACKET sockets e.g. by dhclient
this can lead to a skb_under_panic due to missing skb initialisations.

Add the missing initialisations at the CAN skbuff creation times on driver
level (rx path) and in the network layer (tx path).

Reported-by: Austin Schuh 
Reported-by: Daniel Steer 
Signed-off-by: Oliver Hartkopp 
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2:
 - Adjust context
 - Drop changes to alloc_canfd_skb()]
Signed-off-by: Ben Hutchings

can: dev: fix crtlmode_supported check

2015-02-20T00:49:37+00:00

commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream.

When changing flags in the CAN drivers ctrlmode the provided new content has to
be checked whether the bits are allowed to be changed. The bits that are to be
changed are given as a bitfield in cm->mask. Therefore checking against
cm->flags is wrong as the content can hold any kind of values.

The iproute2 tool sets the bits in cm->mask and cm->flags depending on the
detected command line options. To be robust against bogus user space
applications additionally sanitize the provided flags with the provided mask.

Cc: Wolfgang Grandegger 
Signed-off-by: Oliver Hartkopp 
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

can: esd_usb2: fix memory leak on disconnect

2014-12-14T16:23:57+00:00

commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Matthias Fuchs 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings

can: dev: avoid calling kfree_skb() from interrupt context

2014-12-14T16:23:57+00:00

commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [] dump_stack+0x41/0x52
[ 1153.360782]  [] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [] skb_release_all+0x10/0x30
[ 1153.360795]  [] kfree_skb+0x36/0x80
[ 1153.360799]  [] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [] handle_irq_event+0x31/0x50
[ 1153.360816]  [] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [] handle_irq+0x71/0x90
[ 1153.360823]    [] do_IRQ+0x3c/0xd0
[ 1153.360829]  [] common_interrupt+0x2c/0x34
[ 1153.360834]  [] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [] __schedule+0x35b/0x7e0
[ 1153.360839]  [] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [] ? process_one_work+0x196/0x370
[ 1153.360847]  [] schedule+0x23/0x60
[ 1153.360849]  [] worker_thread+0x161/0x460
[ 1153.360852]  [] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [] kthread+0xa1/0xc0
[ 1153.360859]  [] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings

can: at91_can: add missing prepare and unprepare of the clock

2014-11-05T20:27:45+00:00

commit e77980e50bc2850599d4d9c0192b67a9ffd6daac upstream.

In order to make the driver work with the common clock framework, this patch
converts the clk_enable()/clk_disable() to
clk_prepare_enable()/clk_disable_unprepare(). While there, add the missing
error handling.

Signed-off-by: David Dueck 
Signed-off-by: Anthony Harivel 
Acked-by: Boris Brezillon 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Ben Hutchings